From 8e50cf72561a8077a9e62d9594347e14f4ef2514 Mon Sep 17 00:00:00 2001 From: FrameAutomata Date: Thu, 27 Aug 2026 12:38:30 -0500 Subject: [PATCH 1/3] ci: move the release-path actions off the Node 20 runtime The six actions #326 left after the actions/* sweep, all third-party and all on release workflows: docker/build-push-action v5 -> v7 (release-traceway, 5 uses) docker/setup-qemu-action v3 -> v4 (release-traceway) docker/setup-buildx-action v3 -> v4 (release-traceway) docker/login-action v3 -> v4 (release-traceway) cloudflare/wrangler-action v3 -> v4 (release-website, -docs, -helm) azure/setup-helm v4 -> v5 (release-helm) Every pin in .github/workflows is node24 or composite after this. No PR label exercises any of these, so this wants a workflow_dispatch dry run before merging -- see the PR description for which and in what order. wrangler-action v4 changed its default Wrangler CLI from 3 to 4. Neither website/package.json nor docs/package.json depends on wrangler, so the action's default is what actually deploys tracewayapp.com and the docs: taking v4 unpinned would carry a CLI major bump into a production deploy inside a runtime change. `wranglerVersion: "3"` holds the CLI where it is so this change moves one thing. Wrangler 4 is worth doing, deliberately and on its own. The other five are inert for how they are called here: build-push-action v6 turned on build summaries (default on, additive) and v7 dropped the DOCKER_BUILD_NO_SUMMARY and DOCKER_BUILD_EXPORT_RETENTION_DAYS envs -- neither is set anywhere in the repo. The inputs in use (context, file, push, tags, platforms, cache-from, cache-to) are unchanged. setup-buildx-action v4 removed deprecated inputs and outputs. It is invoked with no inputs and its outputs are not referenced -- the step has no id. login-action v4, setup-qemu-action v4 and setup-helm v5 are Node 24 plus ESM only. login-action's registry/username/password are unchanged, and the other two take no inputs. Refs #326. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/release-docs.yml | 5 ++++- .github/workflows/release-helm.yml | 7 +++++-- .github/workflows/release-traceway.yml | 16 ++++++++-------- .github/workflows/release-website.yml | 7 ++++++- 4 files changed, 23 insertions(+), 12 deletions(-) diff --git a/.github/workflows/release-docs.yml b/.github/workflows/release-docs.yml index 6cd0cf767..64423fe8b 100644 --- a/.github/workflows/release-docs.yml +++ b/.github/workflows/release-docs.yml @@ -31,10 +31,13 @@ jobs: run: npm run build - name: Deploy to Cloudflare - uses: cloudflare/wrangler-action@v3 + uses: cloudflare/wrangler-action@v4 with: apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} + # See release-website.yml: v4 defaults to the Wrangler 4 CLI, a + # separate migration. Pinned so this change is only the runtime move. + wranglerVersion: "3" workingDirectory: docs command: deploy diff --git a/.github/workflows/release-helm.yml b/.github/workflows/release-helm.yml index a5f54ae6d..4e65a5733 100644 --- a/.github/workflows/release-helm.yml +++ b/.github/workflows/release-helm.yml @@ -32,7 +32,7 @@ jobs: fi - name: Install Helm - uses: azure/setup-helm@v4 + uses: azure/setup-helm@v5 - name: Update chart version run: | @@ -84,10 +84,13 @@ jobs: cp chart-pkg/index.yaml deploy/ - name: Deploy index.yaml to Cloudflare Pages - uses: cloudflare/wrangler-action@v3 + uses: cloudflare/wrangler-action@v4 with: apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} + # See release-website.yml: v4 defaults to the Wrangler 4 CLI, a + # separate migration. Pinned so this change is only the runtime move. + wranglerVersion: "3" command: pages deploy deploy --project-name traceway-charts --commit-dirty=true - name: Summary diff --git a/.github/workflows/release-traceway.yml b/.github/workflows/release-traceway.yml index d586175b7..e5ffcf546 100644 --- a/.github/workflows/release-traceway.yml +++ b/.github/workflows/release-traceway.yml @@ -201,13 +201,13 @@ jobs: uses: actions/checkout@v4 - name: Set up QEMU - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@v4 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@v4 - name: Log in to GitHub Container Registry - uses: docker/login-action@v3 + uses: docker/login-action@v4 with: registry: ghcr.io username: ${{ github.actor }} @@ -215,7 +215,7 @@ jobs: - name: Build and push full image id: docker_build_full - uses: docker/build-push-action@v5 + uses: docker/build-push-action@v7 with: context: . file: ./Dockerfile @@ -228,7 +228,7 @@ jobs: - name: Build and push minimal image id: docker_build_minimal - uses: docker/build-push-action@v5 + uses: docker/build-push-action@v7 with: context: . file: ./Dockerfile.minimal @@ -241,7 +241,7 @@ jobs: - name: Build and push SQLite image id: docker_build_sqlite - uses: docker/build-push-action@v5 + uses: docker/build-push-action@v7 with: context: . file: ./Dockerfile.sqlite @@ -258,7 +258,7 @@ jobs: # impractically slow. arm64 users build Dockerfile.duckdb natively. - name: Build and push DuckDB image id: docker_build_duckdb - uses: docker/build-push-action@v5 + uses: docker/build-push-action@v7 with: context: . file: ./Dockerfile.duckdb @@ -275,7 +275,7 @@ jobs: # synthetic checks. - name: Build and push Browser image id: docker_build_browser - uses: docker/build-push-action@v5 + uses: docker/build-push-action@v7 with: context: . file: ./Dockerfile.browser diff --git a/.github/workflows/release-website.yml b/.github/workflows/release-website.yml index 6c2c1bdaf..119c5204d 100644 --- a/.github/workflows/release-website.yml +++ b/.github/workflows/release-website.yml @@ -31,10 +31,15 @@ jobs: run: npm run build - name: Deploy to Cloudflare - uses: cloudflare/wrangler-action@v3 + uses: cloudflare/wrangler-action@v4 with: apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} + # The action bump is only about the Node 24 runtime. wrangler-action + # v4 also changed its default Wrangler CLI from 3 to 4, which is a + # separate migration on a production deploy path -- pinned here so + # this change moves one thing. Drop the pin to take Wrangler 4. + wranglerVersion: "3" workingDirectory: website command: deploy From 245cc4f383ecb1fc4c97afe3371aee6c31dac304 Mon Sep 17 00:00:00 2001 From: FrameAutomata Date: Thu, 27 Aug 2026 12:54:52 -0500 Subject: [PATCH 2/3] ci: bound the build records v7 newly uploads, and give the wrangler pin an owner build-push-action v6+ generates a build summary and uploads a build record artifact per build. release-traceway.yml runs five of them, so the bump silently added five artifacts per release inheriting the repo-wide retention. The summary itself earns its keep -- all five builds write cache-to: type=gha,mode=max and it is the only place per-build cache-hit ratios are visible without re-running a release -- so this caps the record retention at a week rather than disabling the feature. The three wranglerVersion comments deferred to release-website.yml for their rationale, which is a coupling nothing enforces: each of these files is normally read alone in a diff, and rewording or retiring the website comment would silently orphan two pointers. Each site now states its own reason. The pin's exit condition was also prose and nothing else, on a production deploy path, in a repo where unowned version state drifting until it becomes an annotation is the whole subject of #326. Filed as #331 and referenced from all three sites. #330 covers the absent drift detection that let #326 happen twice in one day. Refs #326. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/release-docs.yml | 5 +++-- .github/workflows/release-helm.yml | 5 +++-- .github/workflows/release-traceway.yml | 9 +++++++++ .github/workflows/release-website.yml | 8 ++++---- 4 files changed, 19 insertions(+), 8 deletions(-) diff --git a/.github/workflows/release-docs.yml b/.github/workflows/release-docs.yml index 64423fe8b..5746b88b4 100644 --- a/.github/workflows/release-docs.yml +++ b/.github/workflows/release-docs.yml @@ -35,8 +35,9 @@ jobs: with: apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} - # See release-website.yml: v4 defaults to the Wrangler 4 CLI, a - # separate migration. Pinned so this change is only the runtime move. + # wrangler-action v4 defaults to the Wrangler 4 CLI, a separate + # migration. Pinned so this change is only the runtime move. + # Unpinning is tracked in #331. wranglerVersion: "3" workingDirectory: docs command: deploy diff --git a/.github/workflows/release-helm.yml b/.github/workflows/release-helm.yml index 4e65a5733..9da220fd4 100644 --- a/.github/workflows/release-helm.yml +++ b/.github/workflows/release-helm.yml @@ -88,8 +88,9 @@ jobs: with: apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} - # See release-website.yml: v4 defaults to the Wrangler 4 CLI, a - # separate migration. Pinned so this change is only the runtime move. + # wrangler-action v4 defaults to the Wrangler 4 CLI, a separate + # migration. Pinned so this change is only the runtime move. + # Unpinning is tracked in #331. wranglerVersion: "3" command: pages deploy deploy --project-name traceway-charts --commit-dirty=true diff --git a/.github/workflows/release-traceway.yml b/.github/workflows/release-traceway.yml index e5ffcf546..810ab957a 100644 --- a/.github/workflows/release-traceway.yml +++ b/.github/workflows/release-traceway.yml @@ -196,6 +196,15 @@ jobs: build-docker: runs-on: ubuntu-latest needs: release + env: + # build-push-action v6+ generates a build summary and uploads a build + # record artifact per build. The summary is worth keeping -- all five + # builds below write cache-to: type=gha,mode=max, and it is the only + # place per-build cache-hit ratios show up without re-running a release. + # The records inherit the repo-wide artifact retention by default, so + # five of them accumulate per release; a week is long enough to debug + # the release that produced them. + DOCKER_BUILD_RECORD_RETENTION_DAYS: 7 steps: - name: Checkout uses: actions/checkout@v4 diff --git a/.github/workflows/release-website.yml b/.github/workflows/release-website.yml index 119c5204d..1af9f270d 100644 --- a/.github/workflows/release-website.yml +++ b/.github/workflows/release-website.yml @@ -35,10 +35,10 @@ jobs: with: apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} - # The action bump is only about the Node 24 runtime. wrangler-action - # v4 also changed its default Wrangler CLI from 3 to 4, which is a - # separate migration on a production deploy path -- pinned here so - # this change moves one thing. Drop the pin to take Wrangler 4. + # wrangler-action v4 defaults to the Wrangler 4 CLI, a separate + # migration on a production deploy path. Pinned so this change is + # only the runtime move. + # Unpinning is tracked in #331. wranglerVersion: "3" workingDirectory: website command: deploy From 2c9b8b6a0dbbc928b57c64557869fb441efe3839 Mon Sep 17 00:00:00 2001 From: FrameAutomata Date: Fri, 28 Aug 2026 18:01:44 -0500 Subject: [PATCH 3/3] ci: make the helm wrangler pin exact, matching #331 "3" is a range wrangler-action re-resolves to the newest 3.x on every deploy, so as a pin it only bounds the major. #347 puts the CLI version in website/ and docs/ package-lock.json and pins this job -- the one with no npm project -- to an exact 3.114.17. Adopting that block verbatim here, so the two PRs make byte-identical edits to this file and merge in either order without a conflict. The only line that differs is the one this PR exists for, @v3 -> @v4. The docs and website wranglerVersion pins stay as they are: they are the safety net if this lands before #347, and an installed 3.114.17 satisfies "3" once it does, so the lockfile still decides. They can be dropped in a follow-up once both are in. Refs #326, #331. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/release-helm.yml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release-helm.yml b/.github/workflows/release-helm.yml index 9da220fd4..9639218e7 100644 --- a/.github/workflows/release-helm.yml +++ b/.github/workflows/release-helm.yml @@ -88,10 +88,13 @@ jobs: with: apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} - # wrangler-action v4 defaults to the Wrangler 4 CLI, a separate - # migration. Pinned so this change is only the runtime move. - # Unpinning is tracked in #331. - wranglerVersion: "3" + # website/ and docs/ pin the Wrangler CLI in their package-lock.json + # and the action picks that up; this job has no npm project to hold + # one, so it is the single site that needs the version stated. Exact, + # not a bare major: "3" is a range the action resolves to the newest + # 3.x at deploy time, which is the drift this pin exists to stop. + # Tracked with the other two in #331. + wranglerVersion: "3.114.17" command: pages deploy deploy --project-name traceway-charts --commit-dirty=true - name: Summary